[blessdyb]

Summary

• consolidate Collector, Devices, and Coverage into a single Sources destination with exact recovery and Ask routing
• move Detection into Alerts and durable storage controls into Settings › Data & Privacy
• make source health truthful for unavailable Store collection and empty last-hour coverage
• split CI into parallel change-aware jobs and route CodeQL only for changed languages, with stable fail-closed gates
• refresh all ten localizations, public documentation, deterministic screenshots, and 0.17.3 release metadata

Verification

• complete macOS suite: 1,137 tests, 0 failures, no unexpected test-host restart
• focused Sources/navigation suite: 20 tests, 0 failures
• Developer ID and App Store product graphs build as universal x86_64/arm64 apps at 0.17.3/77
• Store product structure, entitlement sources, extension point, encryption declaration, linkage, and forbidden-artifact checks pass
• CodeQL gate fixtures prove classifier/analyzer failures and malformed routes are rejected
• site validator: 53 pages, 0 problems; product-specific shortcut failure fixture passes
• localization parity: 1,750/1,750 strings in all ten catalogs
• Xcode project drift, Swift warning gates, release-policy fixtures, and git diff --check pass
• exact Developer candidate exercised on this Mac in deterministic demo acceptance; published screenshots were visually reviewed in light mode

Release ordering

Do not merge this PR until immutable v0.17.3 publication and independent public-artifact acceptance have completed.

🤖 Generated with Claude Code